Disclosed vulnerability
CVE-2026-91998: Casdoor /api/mcp authorization bypass enables cross-organization user administration
AIR-2026-0243 AIR record · 2026-09-casdoor-mcp-authz-bypass
From the supporting source
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations.cveawg.mitre.org
The record
Disclosed
2026-09-15
Vendor
Casdoor (Casbin)
Product
Casdoor
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — MCP endpoint authorization bypass; no model decision
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Application credential authz bypass
Impact type
Authorization bypass, Cross tenant access, Account takeover, Credential disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Casdoor <= 4.4.0; any application's clientId/clientSecret grants admin over every organization
Capability abused
Defense & remediation
Recorded defense
Casbin policy + per-organization scoping
Guardrail kinds
Unknown
Guardrail outcome
Silent
Taxonomy & references
Curator notes
CVSS 9.9 (v3.1) / 9.4 (v4.0). Assigned by VulnCheck; reported by George Chen (geo-chen). authz.go returns an unconditional allow for any subject owned by 'app', skipping Casbin and org scoping. PoC 'confirmed against the built binary' (attacker app credentials read, created an admin and deleted a user in a different organization) - lab confirmation, no real third-party victim, so impact_realized false. No fixed version stated in the advisory at disclosure.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-91998: Casdoor /api/mcp authorization bypass enables cross-organization user administration". AIR, AIR-2026-0243. https://agentincident.vercel.app/i/AIR-2026-0243/ (accessed 2026-10-19).